csirp/eradication/procedures.md

Eradication Procedures

1. Identify Root Cause

• Analyze logs, memory dumps, and network traffic
• Identify entry point and attacker TTPs
• Document IOCs

2. Remove Threat

• Remove malware and backdoors
• Close unauthorized access points
• Patch exploited vulnerabilities

3. Validate

• Confirm systems are clean
• Monitor for recurring indicators